1   1  /  1  页   跳转

[求助] 计算机被远程控制。。。

计算机被远程控制。。。

这是扫描下来的,麻烦各位帮我看看,




日志文件: 趋势科技 HijackThis v2.0.0 (BETA)
保存时间: 13:52:22, on 2007-7-30
操作系统: Windows XP SP3 (WinNT 5.01.2600)
启动模式: 正常
正在运行的进程:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOPRO\TPPOLL.EXE
C:\Program Files\Filseclab\Twister\twister.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\360\360sd\360sd.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
D:\Program Files\Tencent\QQ\QQ.exe
D:\Program Files\Tencent\QQ\TXPlatform.exe
C:\Program Files\Tencent\TT\bin\TTraveler.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\Administrator\桌面\ha_hijackthisv2_pp\HiJackThis_v2.exe
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - HKLM\..\Run: [tppoll] C:\Program Files\TOPRO\TPPOLL.EXE
O4 - HKLM\..\Run: [360sd] C:\Program Files\360\360sd\360sdrun.exe
O4 - HKLM\..\Run: [twister] "C:\Program Files\Filseclab\Twister\twister.exe" -a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: QQ游戏启动加速程序.lnk = C:\Program Files\Tencent\QQGAME\Accel.exe
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: 书报递送.lnk = ?
O4 - Global Startup: 费尔消息服务.lnk = ?
O8 - 扩展右键菜单项: 使用迅雷下载 - C:\Program Files\Thunder\Program\geturl.htm
O8 - 扩展右键菜单项: 使用迅雷下载全部链接 - C:\Program Files\Thunder\Program\getallurl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: (未命名) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\xunyount.dll
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/2121/aliedit.cab
O16 - DPF: {9FAFB576-6933-4CCC-AB3D-B988EC43D04E} (Rising Online Antivirus scanner control) - http://download.rising.com.cn/rs2009/online/ravolctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F597A90-7332-407B-8A4D-47613F3AD951}: NameServer = 202.96.128.86 202.96.128.166
O18 - Protocol: mbox - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mboxflash - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O22 - SharedTaskScheduler: Browseui 预加载程序 - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: 组件类别缓存程序 - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: A6H5NT (0VH1YLWC) - Unknown owner - C:\WINDOWS\0VH1YLWC.exe (file missing)
O23 - Service: BEHP1RB43Y (1I2DVWD) - Unknown owner - C:\WINDOWS\1I2DVWD.exe (file missing)
O23 - Service: 360rp - 360安全中心 - C:\Program Files\360\360sd\360rp.exe
O23 - Service: GIROE71C (48ID7W9DCD) - Unknown owner - C:\WINDOWS\48ID7W9DCD.exe (file missing)
O23 - Service: FJD05H13 (4XEYZ99C17) - Unknown owner - C:\WINDOWS\4XEYZ99C17.exe (file missing)
O23 - Service: B1HSQURFY2 (5FZ4PYC6WB7M) - Unknown owner - C:\WINDOWS\5FZ4PYC6WB7M.exe (file missing)
O23 - Service: HNX4DXX (8J7Y7KHQ) - Unknown owner - C:\WINDOWS\8J7Y7KHQ.exe (file missing)
O23 - Service: FA0R2LRK1IW (9TUEK) - Unknown owner - C:\WINDOWS\9TUEK.exe (file missing)
O23 - Service: agl - Unknown owner - C:\WINDOWS\system32\agl.exe (file missing)
O23 - Service: P3V9KFO8G07Z (AHNDZ) - Unknown owner - C:\WINDOWS\AHNDZ.exe (file missing)
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Ares\chatServer.exe
O23 - Service: ROKYV (CLZ5PM0044) - Unknown owner - C:\WINDOWS\CLZ5PM0044.exe (file missing)
O23 - Service: SPTQZBB (FT7JADK9X) - Unknown owner - C:\WINDOWS\FT7JADK9X.exe (file missing)
O23 - Service: TKGBE9DZBC (G5O1YAKPB1W) - Unknown owner - C:\WINDOWS\G5O1YAKPB1W.exe (file missing)
O23 - Service: G20NCVE (GB7MTBVGI) - Unknown owner - C:\WINDOWS\GB7MTBVGI.exe (file missing)
O23 - Service: WUU3G7QTQ3OD (ISTBN1VZH) - Unknown owner - C:\WINDOWS\ISTBN1VZH.exe (file missing)
O23 - Service: ZX1CMXMY4VFZ (JYJG2S7FO) - Unknown owner - C:\WINDOWS\JYJG2S7FO.exe (file missing)
O23 - Service: lasas - Unknown owner - C:\WINDOWS\system32\lasas.exe (file missing)
O23 - Service: npkcmsvc - Unknown owner - D:\MXD\冒险岛online\npkcmsvc.exe (file missing)
O23 - Service: NV0DIA Dispy Driverv  (NV0DIA Dispy Driverv) - Unknown owner - C:\WINDOWS\svuhier.exe (file missing)
O23 - Service: NVI0DIA Dispy Driverv  (NVI0DIA Dispy Driverv) - Unknown owner - C:\WINDOWS\svhiser.exe (file missing)
O23 - Service: NVIDIA Dissplay Drilverv - Unknown owner - C:\WINDOWS\guocyok88.exe (file missing)
O23 - Service: qdw - Unknown owner - C:\WINDOWS\system32\qdw.exe (file missing)
O23 - Service: scvst - Unknown owner - C:\WINDOWS\system32\scvst.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: svch0st - Unknown owner - C:\WINDOWS\system32\svch0st.exe (file missing)
O23 - Service: svost - Unknown owner - C:\WINDOWS\system32\svost.exe (file missing)
O23 - Service: tstm - Unknown owner - C:\WINDOWS\system32\tstm.exe (file missing)
O23 - Service: Tencent Software Update Service (TSUSVC) - Tencent - C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe
O23 - Service: 7GEOJ (V3YTHNR) - Unknown owner - C:\WINDOWS\V3YTHNR.exe (file missing)
O23 - Service: Winets Server (Winet) - Unknown owner - C:\WINDOWS\system32\Winet.exe (file missing)

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler 4.0)

附件附件:

文件名:SREngLOG.log
下载次数:173
文件类型:application/octet-stream
文件大小:
上传时间:2009-7-30 15:22:06
描述:log

最后编辑颜似的似的 最后编辑于 2009-07-30 15:22:06
分享到:
gototop
 

回复:计算机被远程控制。。。

请问是这个文件的问题吗?Winet.exe
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT